cyber.hendryadrian.com
Threat Research · opensourcemalware.com

DPRK-Linked npm Malware Hides C2 IP in Blank Ethereum Transfer Addresses

· Original article ↗

Summary

Researchers found two trojanized npm packages using a new blockchain-based C2 technique: decoding an IP address from the recipient address of a zero-value, zero-data Ethereum transfer.

Key points

  • The technique, dubbed NullReceiver, was found in bianira-ui@1.27.0 and fluid-type-ui@2.0.8, packages described as DPRK-linked clones of Tailwind CSS plugins.
  • The malware checks an attacker-controlled wallet’s latest outbound transaction and decodes the C2 IP from its recipient address.
  • The reported transaction contains no value or transaction data; its recipient address also includes the ASCII string “helloipbot!!”.
  • Researchers recovered C2 infrastructure at 166.88.134.62 on ports 443 and 80.
  • Unlike EtherHiding, NullReceiver uses a new disposable recipient address for each lookup and does not rely on a smart contract or calldata, but it can encode only a small amount of data.
  • The researchers say their findings came from static analysis of the npm packages and read-only blockchain lookups; they did not execute the packages.

Article Details

Attack Vectors
  • Trojanized npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 implement a Node.js RAT using the NullReceiver technique: they query a hardcoded attacker Ethereum wallet, inspect its most recent outbound transaction, decode the C2 IP from the recipient-address bytes of a zero-value, zero-data transfer, and connect to that IP.
  • The packages use blockchain activity as a C2 dead drop, with the recipient address of each lookup transaction acting as a disposable carrier for the C2 IP.
Defensive Notes
  • Monitor suspicious blockchain lookups and the attacker wallet identified in the article; the article notes that the sending wallet is reused across both packages.
  • Inspect transaction recipient-address bytes as well as transaction data and smart-contract calls; NullReceiver transactions have zero value and empty data, and use newly generated recipient addresses.
  • The article reports that findings came from static analysis of published npm tarballs and read-only blockchain lookups; the researchers state they did not execute the packages.

Indicators of compromise

TypeIndicatorContext
DOMAINeth[.]drpc[.]orgEthereum RPC endpoint listed in the package code for blockchain lookups.
HOSTNAME166[.]88[.]134[.]62C2 host listed with ports 443 and 80.
IPV4166[.]88[.]134[.]62C2 IP decoded from the NullReceiver transaction recipient address.
URLhxxps[:]//1rpc[.]io/ethEthereum RPC endpoint listed in the package code for blockchain lookups.

Threat Actors

DPRK “Contagious Interview” campaignThe article attributes the trojanized npm packages and NullReceiver technique to this DPRK-linked campaign.

Malware

NullReceiverWe’re calling it NullReceiver, and we think it’s a deliberate improvement on EtherHiding.

Related Articles